--- title: CISA orders feds to patch actively exploited TrueConf... description: CISA has ordered US federal agencies to patch two actively exploited critical vulnerabilities in TrueConf Server, a self-hosted video conferencing platform.... canonical: https://daily.dev/posts/cisa-orders-feds-to-patch-actively-exploited-trueconf-server-flaws-bnvszmcme twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CISA orders feds to patch actively exploited TrueConf Server flaws | daily.dev og:description: CISA has ordered US federal agencies to patch two actively exploited critical vulnerabilities in TrueConf Server, a self-hosted video conferencing platform.... og:url: https://daily.dev/posts/cisa-orders-feds-to-patch-actively-exploited-trueconf-server-flaws-bnvszmcme og:image: https://api.daily.dev/og/posts/bnvsZMCMe.png og:image:alt: CISA orders feds to patch actively exploited TrueConf Server flaws og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CISA orders feds to patch actively exploited TrueConf Server flaws **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 2 min read · 0 upvotes · 0 comments ## Summary CISA has ordered US federal agencies to patch two actively exploited critical vulnerabilities in TrueConf Server, a self-hosted video conferencing platform. CVE-2026-72529 allows unauthenticated remote script execution via an undocumented function over TCP port 4307, while CVE-2026-72530 enables sandbox escape and code execution through code injection. Federal agencies must remediate by September 3, 2026. Kaspersky attributes ongoing exploitation since July 2026 to the Head Mare hacktivist group, which has been trojanizing TrueConf client installers to deploy backdoors, primarily targeting Russian organizations. This follows an earlier April 2026 zero-day (CVE-2026-3502) linked to Chinese threat actors in a campaign dubbed Operation True Chaos. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-72529 in TrueConf Server and how does it work? CVE-2026-72529 is a critical missing authentication vulnerability in TrueConf Server that lets a remote unauthenticated attacker connect over TCP port 4307 and invoke an undocumented critical function to execute an arbitrary script on the server. It has been added to CISA's Known Exploited Vulnerabilities catalog, with federal agencies ordered to patch by September 3, 2026. _Teams running self-hosted TrueConf deployments can track disclosures like this as new CVEs surface on daily.dev._ ### What is CVE-2026-72530 and how is it different from CVE-2026-72529 in TrueConf Server? CVE-2026-72530 is a critical code injection vulnerability that lets an unauthenticated attacker who has achieved code execution inside TrueConf Server's isolated sandbox escape it and run arbitrary commands on the underlying operating system. Unlike CVE-2026-72529's missing authentication flaw, exploitation of CVE-2026-72530 is high-complexity but still allows full remote code execution. _Security engineers comparing sandbox escape flaws across products can follow ongoing TrueConf coverage on daily.dev._ ### Who is exploiting the TrueConf Server vulnerabilities and what is the goal? Kaspersky attributes exploitation of CVE-2026-72529 and CVE-2026-72530 to the Head Mare hacktivist group, active since at least July 2026, which replaces TrueConf client installers with trojanized versions to deploy backdoor malware. Targets span Russian organizations in transportation, energy, IT, electronics, and software development sectors. _Analysts tracking threat actor campaigns against collaboration software can follow updates like this on daily.dev._ ## Similar posts on daily.dev - [CISA sets urgent deadline to fix Cisco flaw exploited in attacks](https://daily.dev/posts/cisa-sets-urgent-deadline-to-fix-cisco-flaw-exploited-in-attacks-dfknamsxp) · BleepingComputer · 0 upvotes · 0 comments - [Operation TrueChaos: 0-Day Exploitation Against Southeast Asian Government Targets](https://daily.dev/posts/operation-truechaos-0-day-exploitation-against-southeast-asian-government-targets-boghs0d4o) · Check Point Research · 0 upvotes · 0 comments - [CISA: Critical VMware RCE flaw now exploited by ransomware gangs](https://daily.dev/posts/cisa-critical-vmware-rce-flaw-now-exploited-by-ransomware-gangs-ofrnqjulv) · BleepingComputer · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/cisa-orders-feds-to-patch-actively-exploited-trueconf-server-flaws-bnvszmcme) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CISA orders feds to patch actively exploited TrueConf Server flaws","url":"https://daily.dev/posts/cisa-orders-feds-to-patch-actively-exploited-trueconf-server-flaws-bnvszmcme","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cisa-orders-feds-to-patch-actively-exploited-trueconf-server-flaws-bnvszmcme"},"datePublished":"2026-08-21T12:25:47.315Z","dateModified":"2026-08-24T07:00:37.540Z","description":"CISA has ordered US federal agencies to patch two actively exploited critical vulnerabilities in TrueConf Server, a self-hosted video conferencing platform....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3536228e363c291a8b5671c819f6c669?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3536228e363c291a8b5671c819f6c669?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cisa-orders-feds-to-patch-actively-exploited-trueconf-server-flaws-bnvszmcme","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"CISA orders feds to patch actively exploited TrueConf Server flaws"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cisa-orders-feds-to-patch-actively-exploited-trueconf-server-flaws-bnvszmcme#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-72529 in TrueConf Server and how does it work?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-72529 is a critical missing authentication vulnerability in TrueConf Server that lets a remote unauthenticated attacker connect over TCP port 4307 and invoke an undocumented critical function to execute an arbitrary script on the server. It has been added to CISA's Known Exploited Vulnerabilities catalog, with federal agencies ordered to patch by September 3, 2026. Teams running self-hosted TrueConf deployments can track disclosures like this as new CVEs surface on daily.dev."}},{"@type":"Question","name":"What is CVE-2026-72530 and how is it different from CVE-2026-72529 in TrueConf Server?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-72530 is a critical code injection vulnerability that lets an unauthenticated attacker who has achieved code execution inside TrueConf Server's isolated sandbox escape it and run arbitrary commands on the underlying operating system. Unlike CVE-2026-72529's missing authentication flaw, exploitation of CVE-2026-72530 is high-complexity but still allows full remote code execution. Security engineers comparing sandbox escape flaws across products can follow ongoing TrueConf coverage on daily.dev."}},{"@type":"Question","name":"Who is exploiting the TrueConf Server vulnerabilities and what is the goal?","acceptedAnswer":{"@type":"Answer","text":"Kaspersky attributes exploitation of CVE-2026-72529 and CVE-2026-72530 to the Head Mare hacktivist group, active since at least July 2026, which replaces TrueConf client installers with trojanized versions to deploy backdoor malware. Targets span Russian organizations in transportation, energy, IT, electronics, and software development sectors. Analysts tracking threat actor campaigns against collaboration software can follow updates like this on daily.dev."}}]} ```